Last Comment Bug 765313 - script->types is getting thrown out too soon in JSScript::ensureRanAnalysis
: script->types is getting thrown out too soon in JSScript::ensureRanAnalysis
Status: RESOLVED FIXED
[js:t]
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla16
Assigned To: Bill McCloskey (:billm)
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-15 11:11 PDT by Bill McCloskey (:billm)
Modified: 2012-06-23 05:46 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (770 bytes, patch)
2012-06-15 11:11 PDT, Bill McCloskey (:billm)
bhackett1024: review+
Details | Diff | Review

Description Bill McCloskey (:billm) 2012-06-15 11:11:46 PDT
Created attachment 633588 [details] [diff] [review]
patch

The problem is that we call script->ensureHasTypes at the top of JSScript::ensureRanAnalysis. A little later, we call something that expects script->types to be non-NULL. If we GC in the middle, we get failures. I found this while running with GC zeal.

This may or may not be the right fix, but it worked for me.
Comment 2 Ryan VanderMeulen [:RyanVM] 2012-06-23 05:46:17 PDT
https://hg.mozilla.org/mozilla-central/rev/868fd5e81dd7

Note You need to log in before you can comment on or make changes to this bug.